GHSA-7jvp-hj45-2f2m: Scriban: Template Writes to Arbitrary CLR Properties via `TypedObjectAccessor` (Mass Assignment + `private` / `init` / `internal` Setter Bypass)
| Declaration | Developer intent | Actual behavior |
|---|---|---|
| { get; set; } | writable | writable (mass assignment — A) |
| { get; private set; } | only the owning class writes | template writes freely |
| { get; internal set; } | only the declaring assembly writes | template writes freely |
| { get; init; } | immutable after construction (C# 9 language guarantee) | template writes freely post-construction |
References
Code Behaviors & Features
Detect and mitigate GHSA-7jvp-hj45-2f2m with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →